Received: by 2002:a05:6358:3188:b0:123:57c1:9b43 with SMTP id q8csp489355rwd; Sat, 27 May 2023 01:00:44 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ5mDSocJDEWJ31yBRrhhK3J9kqggyz/vjzT9QjrcH26yIgpToBX/ko0kRoSQzcw+JANzlVF X-Received: by 2002:a05:6a00:2d84:b0:64d:6c6f:84f2 with SMTP id fb4-20020a056a002d8400b0064d6c6f84f2mr7086798pfb.19.1685174444071; Sat, 27 May 2023 01:00:44 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1685174444; cv=none; d=google.com; s=arc-20160816; b=PHnjFgB/wUthi23G1QQ2EfU27POuRP3GKhQKqaKvAQskcAdGxG1D/pfub6aH1DZc5a SR5elZuwjFBjj9wgF2DQGi3d6bRJAl++qpU8VVpYvKD7ZovNmb8dao6A/ODlSlQrF0dD dMRk5Rfi0i3ADwXHnZd4Db9NRX85NussktpPejX1Pph3ME0sLda4UHTGWRVerugxXmfn 0Le3gNrRr/iR+5VOuD6noX6Zqs0wji+iNjFpQoaYKiGO7Xv6EmB1yNbdXbjLK7uaS0Mi KfzuouAwMJD2XySbYWDfeGsoKRhiALejM+pFV8Zf6fgu4KA6UjO9SaNi68oAz2YAyWbD yBZg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=ps1IF/L3y0LuIXv1kuyXMXVV1V92IKkA4nkdR1TZzsU=; b=hfWaxQ3OoCA9pTtJjMBgEbKNJC2oiBPi+GmAztgnf133TSXwbT1Vpp0T7BRgX3kxbR TQLo0vHIEPmnSQV2BIwvykm027BbNwC86TNRXbooWcbOLHcsmG/k/OpCtdT6Jcf5tgPX G57Prv4qY4erULQvrtpQO0Bx3ArxKBB7qiAA52YtEAgr7xGjBqOyPgydJQ3W7kTu/nOW 5fN/pLvqenBc+cyN2qgmNM0mFenhP7L6G1wMk5yk+rZQbIrWVTjtrKlnc8NSZ7JCyRJr wzgQ27A8GVgrZ7GZLdv6VXSg6h4Qx9w8bxXYaj/6e2SuBeGbYt3Alq73sBgaUVIR/dEV bKEA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20221208 header.b=J1k3fPaQ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id r1-20020aa79621000000b0063d48d82e85si6307476pfg.15.2023.05.27.01.00.31; Sat, 27 May 2023 01:00:44 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20221208 header.b=J1k3fPaQ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231862AbjE0Hyr (ORCPT + 99 others); Sat, 27 May 2023 03:54:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45374 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230133AbjE0Hyp (ORCPT ); Sat, 27 May 2023 03:54:45 -0400 Received: from mail-pf1-x431.google.com (mail-pf1-x431.google.com [IPv6:2607:f8b0:4864:20::431]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 73ADDBB; Sat, 27 May 2023 00:54:44 -0700 (PDT) Received: by mail-pf1-x431.google.com with SMTP id d2e1a72fcca58-64f1f133c37so343487b3a.0; Sat, 27 May 2023 00:54:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1685174084; x=1687766084; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=ps1IF/L3y0LuIXv1kuyXMXVV1V92IKkA4nkdR1TZzsU=; b=J1k3fPaQZMPaMfdKrnm1zm7gzhHU3qdmAEgC4wn/zWlP5HZ6JqC5OlOYRpBy+aPcQg yUhoygdEbaP/d6l50zsX+P2x/nCpG+WCQ3vo2jEYDG6kXl3wiY3GZCZeW+KK7JfJUpXb vglxbKZsZSapWDZ6FUSrA82OzrEKw49uNha6r3OrW2h+wK+WUgqPh8mybzRX0ER05svx YYA6tu4labf09OfctbtGzSUoFMvh+n05rb5TndVmhR89vfRWC7USJ3BZBiHfKfvK5I6A uDJ1Kg6CpMzxNxSyjL2LyjV+88Akn+4O1hOLrEvQDDmCoLXemg9Gg6AS8g50KFwbTkEl 6+Iw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1685174084; x=1687766084; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=ps1IF/L3y0LuIXv1kuyXMXVV1V92IKkA4nkdR1TZzsU=; b=MdtLaB7Exo9P2dk5ePZu+ThbHhs0/u5nPxdYjtyWJ+Btl9CQOsPmTZ6x0Nr6gBAIAu sQAsOI21RtiCtVjWXlDjm0eNkI6lk88lCjk8qMHHiR6Sg+SQRi6BUQ62OSFuMUef7TBc AoZdSDoTHuQqenT0NM4xIwzU+pSWojfjWYh3inN+36sdDVfTERVKKkCxgpsQLF3xRKcg m24lQsWUzQnFe5uz4ra8gxV+Rt2G8u3EEwOE/70QCAtgSrH+L6MYMMvqzx56Gzc7zlfM OxKMPnYS56Fgia9Dq4kbThK4KZbXW39tUh7eTldM1WcB+n+Mhde3hGhqiH8nH3CgUkOM GKyw== X-Gm-Message-State: AC+VfDxoLp5zjGxMeY+qXF7gaG4UyH2ALrr0ekzTpFDb/mahK055WP8C fhaBI15Wc5q931vaucjb++I= X-Received: by 2002:a05:6a00:349b:b0:64d:41f1:7c87 with SMTP id cp27-20020a056a00349b00b0064d41f17c87mr5793226pfb.2.1685174083809; Sat, 27 May 2023 00:54:43 -0700 (PDT) Received: from ubuntu.localdomain ([103.114.158.1]) by smtp.gmail.com with ESMTPSA id v7-20020a63d547000000b0053f22b76cdcsm3770567pgi.82.2023.05.27.00.54.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 27 May 2023 00:54:43 -0700 (PDT) From: Min Li To: alexander.deucher@amd.com Cc: christian.koenig@amd.com, Xinhui.Pan@amd.com, airlied@gmail.com, daniel@ffwll.ch, sumit.semwal@linaro.org, amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, linaro-mm-sig@lists.linaro.org Subject: [PATCH] drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl Date: Fri, 26 May 2023 20:37:53 +0800 Message-Id: <20230526123753.16160-1-lm0963hack@gmail.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-1.1 required=5.0 tests=BAYES_00,DATE_IN_PAST_12_24, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Userspace can race to free the gobj(robj converted from), robj should not be accessed again after drm_gem_object_put, otherwith it will result in use-after-free. Signed-off-by: Min Li --- drivers/gpu/drm/radeon/radeon_gem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c index bdc5af23f005..450c7cbdd28a 100644 --- a/drivers/gpu/drm/radeon/radeon_gem.c +++ b/drivers/gpu/drm/radeon/radeon_gem.c @@ -478,7 +478,7 @@ int radeon_gem_set_domain_ioctl(struct drm_device *dev, void *data, drm_gem_object_put(gobj); up_read(&rdev->exclusive_lock); - r = radeon_gem_handle_lockup(robj->rdev, r); + r = radeon_gem_handle_lockup(rdev, r); return r; } -- 2.34.1